devrites 5.4.0 → 5.6.0

package/engine/internal/state/budgets.go

@@ -0,0 +1,163 @@
+package state
+
+import (
+	"bytes"
+	"strings"
+)
+
+// Artifact budgets mirror workspace-artifact-schema.md "What each file owns".
+// A line budget also bounds bytes at BudgetBytesPerLine per budgeted line so a
+// few very long lines cannot evade it.
+const (
+	BudgetBytesPerLine = 400
+	// BudgetBlockFactor is the material-overshoot threshold. At or above this
+	// multiple of a line or byte budget a gate blocks unless the artifact
+	// records a structural `Budget override:` line; smaller overshoots are
+	// reported by `orient` and stay advisory.
+	BudgetBlockFactor = 1.5
+	// MaxArtifactBytes is the per-artifact read cap. A larger artifact cannot be
+	// observed and blocks as file_too_large, so callers that explain a size
+	// problem quote the same number the observer enforced.
+	MaxArtifactBytes = maxArtifactBytes
+	// PacketMaxBytes is the serialized-packet ceiling from context-hygiene.md:
+	// "A serialized packet stays <= 64 KiB; larger means the scope is wrong".
+	// A non-canonical workspace-root file over it is unsanctioned placement.
+	PacketMaxBytes = 64 << 10
+)
+
+var artifactLineBudgets = map[string]int{
+	"README.md":            120,
+	"brief.md":             80,
+	"spec.md":              260,
+	"decision-coverage.md": 200,
+	"strategy.md":          180,
+	"architecture.md":      180,
+	"flows.md":             160,
+	"decisions.md":         200,
+	"assumptions.md":       160,
+	"questions.md":         180,
+	"plan.md":              220,
+	"tasks.md":             280,
+	"traceability.md":      220,
+	"eng-review.md":        240,
+	"test-plan.md":         260,
+	"state.md":             120,
+	"evidence.md":          280,
+	"browser-evidence.md":  220,
+	"drift.md":             160,
+	"touched-files.md":     160,
+	"design-brief.md":      160,
+	"handoff.md":           120,
+	"polish-report.md":     200,
+	"ship.md":              120,
+	"review.md":            240,
+	"seal.md":              200,
+	"ai-spec.md":           160,
+}
+
+// advisoryOnlyArtifacts are append-only proof ledgers: they scale with proof
+// volume, not with planning surface, so their budget stays advisory in `orient`
+// and never blocks a gate. touched-files.md keeps its own deterministic
+// manifest limits.
+var advisoryOnlyArtifacts = map[string]bool{
+	"evidence.md":         true,
+	"browser-evidence.md": true,
+	"touched-files.md":    true,
+}
+
+// ArtifactLineBudget returns the documented line budget for a canonical artifact.
+func ArtifactLineBudget(name string) (int, bool) {
+	budget, ok := artifactLineBudgets[name]
+	return budget, ok
+}
+
+// sanctionedRootFiles are workspace-root files the schema places there without a
+// line budget: conditional artifacts (`references.md`, `investigation-map.md`,
+// `dogfood.md`) and the engine-owned parallel lease. Anything else in the root
+// is unsanctioned placement — `packets/` and `history/` own by-reference
+// packets and relocated narrative (workspace-artifact-schema.md "Required by
+// phase").
+var sanctionedRootFiles = map[string]bool{
+	"references.md":        true,
+	"investigation-map.md": true,
+	"dogfood.md":           true,
+	"parallel-lease.md":    true,
+}
+
+// SanctionedRootFile reports whether name is a legitimate workspace-root file:
+// a budgeted canonical artifact or a documented unbudgeted one.
+func SanctionedRootFile(name string) bool {
+	if _, ok := artifactLineBudgets[name]; ok {
+		return true
+	}
+	return sanctionedRootFiles[name]
+}
+
+// ArtifactBudgetGateApplies reports whether the deterministic material-overshoot
+// gate covers this artifact (canonical and not an advisory-only proof ledger).
+func ArtifactBudgetGateApplies(name string) bool {
+	_, ok := artifactLineBudgets[name]
+	return ok && !advisoryOnlyArtifacts[name]
+}
+
+// ArtifactBudgetStatus is one canonical artifact measured against its budget.
+type ArtifactBudgetStatus struct {
+	File       string
+	Lines      int
+	Bytes      int64
+	LineBudget int
+	ByteBudget int64
+	Over       bool
+	Material   bool
+	Override   bool
+}
+
+// ArtifactBudget measures raw against the named artifact's budget. ok is false
+// for a non-canonical file name.
+func ArtifactBudget(name string, raw []byte) (ArtifactBudgetStatus, bool) {
+	lineBudget, ok := artifactLineBudgets[name]
+	if !ok {
+		return ArtifactBudgetStatus{}, false
+	}
+	status := ArtifactBudgetStatus{
+		File:       name,
+		Lines:      CountLines(raw),
+		Bytes:      int64(len(raw)),
+		LineBudget: lineBudget,
+		ByteBudget: int64(lineBudget) * BudgetBytesPerLine,
+	}
+	status.Over = status.Lines > lineBudget || status.Bytes > status.ByteBudget
+	status.Material = float64(status.Lines) >= float64(lineBudget)*BudgetBlockFactor ||
+		float64(status.Bytes) >= float64(status.ByteBudget)*BudgetBlockFactor
+	status.Override = HasBudgetOverride(raw)
+	return status, true
+}
+
+// CountLines counts newline-terminated lines plus a final unterminated line.
+func CountLines(raw []byte) int {
+	if len(raw) == 0 {
+		return 0
+	}
+	lines := bytes.Count(raw, []byte{'\n'})
+	if raw[len(raw)-1] != '\n' {
+		lines++
+	}
+	return lines
+}
+
+// HasBudgetOverride reports a structural `Budget override:` line outside fenced
+// code blocks; a fenced example never counts.
+func HasBudgetOverride(raw []byte) bool {
+	fenced := false
+	for _, line := range strings.Split(string(raw), "\n") {
+		trimmed := strings.TrimSpace(line)
+		if strings.HasPrefix(trimmed, "```") {
+			fenced = !fenced
+			continue
+		}
+		if !fenced && strings.HasPrefix(trimmed, "Budget override:") {
+			return true
+		}
+	}
+	return false
+}

package/engine/internal/state/budgets_test.go

@@ -0,0 +1,42 @@
+package state
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestArtifactBudgetMeasuresLinesBytesAndMateriality(t *testing.T) {
+	if _, ok := ArtifactBudget("notes.json", []byte("x")); ok {
+		t.Fatal("non-canonical files have no budget")
+	}
+	within, ok := ArtifactBudget("tasks.md", []byte("# Tasks\n## SLICE-001 A\nDependencies: none\n"))
+	if !ok || within.Over || within.Material {
+		t.Fatalf("within=%+v", within)
+	}
+	over, _ := ArtifactBudget("tasks.md", []byte(strings.Repeat("x\n", 300)))
+	if !over.Over || over.Material {
+		t.Fatalf("300 lines against a 280-line budget must be over but not material: %+v", over)
+	}
+	material, _ := ArtifactBudget("tasks.md", []byte(strings.Repeat("x\n", 500)))
+	if !material.Material {
+		t.Fatalf("500 lines must be material: %+v", material)
+	}
+	longLine, _ := ArtifactBudget("state.md", []byte(strings.Repeat("y", 100_000)+"\n"))
+	if !longLine.Material || longLine.Lines != 1 {
+		t.Fatalf("one very long line must trip the byte budget: %+v", longLine)
+	}
+}
+
+func TestHasBudgetOverrideIgnoresFencedExamples(t *testing.T) {
+	if HasBudgetOverride([]byte("plain text\nBudget override: relocation pending\n")) != true {
+		t.Fatal("structural override line must be recognized")
+	}
+	fenced := "See the schema:\n\n```markdown\nBudget override: <reason>\n```\n\nNothing recorded.\n"
+	if HasBudgetOverride([]byte(fenced)) {
+		t.Fatal("a fenced example is not an override")
+	}
+	indented := "  Budget override: table form is required\n"
+	if !HasBudgetOverride([]byte(indented)) {
+		t.Fatal("leading whitespace must not hide a real override line")
+	}
+}

package/engine/internal/state/cursor.go

@@ -12,15 +12,19 @@ import (
 // remain local to the cursor package; normalizeCursorKey still accepts legacy
 // presentation aliases at the text boundary.
 const (
-	CursorPhase              = "phase"
-	CursorStatus             = "status"
-	CursorNextAction         = "next_action"
-	CursorQuestionID         = "question_id"
-	CursorActiveSlice        = "active_slice"
-	CursorAFKSlicesRemaining = "afk_slices_remaining"
-	CursorReturnPhase        = "return_phase"
-	CursorReturnNextAction   = "return_next_action"
-	CursorSchema             = "schema"
+	CursorPhase                    = "phase"
+	CursorStatus                   = "status"
+	CursorNextAction               = "next_action"
+	CursorQuestionID               = "question_id"
+	CursorActiveSlice              = "active_slice"
+	CursorAFKSlicesRemaining       = "afk_slices_remaining"
+	CursorSequenceParent           = "sequence_parent"
+	CursorSequencePosition         = "sequence_position"
+	CursorSequenceWorkspacesRemain = "sequence_workspaces_remaining"
+	CursorSequenceRole             = "sequence_role"
+	CursorReturnPhase              = "return_phase"
+	CursorReturnNextAction         = "return_next_action"
+	CursorSchema                   = "schema"
 )
 
 var cursorKeyAliases = map[string]string{
@@ -273,7 +277,9 @@ func isMigratableCursorKey(key string) bool {
 func canonicalCursorSpelling(key string) (string, bool) {
 	normalized := normalizeCursorKey(key)
 	canonicals := []string{CursorPhase, CursorStatus, CursorNextAction, CursorQuestionID,
-		CursorActiveSlice, CursorAFKSlicesRemaining, CursorReturnPhase,
+		CursorActiveSlice, CursorAFKSlicesRemaining, CursorSequenceParent,
+		CursorSequencePosition, CursorSequenceWorkspacesRemain, CursorSequenceRole,
+		CursorReturnPhase,
 		CursorReturnNextAction, CursorSchema}
 	for _, canonical := range canonicals {
 		if normalized == normalizeCursorKey(canonical) {

package/engine/internal/state/observation.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"sort"
 	"strings"
 
 	"github.com/devrites/devrites/internal/devritespaths"
@@ -90,9 +91,22 @@ func (f ArtifactFact) Diagnostic() (ArtifactDiagnostic, bool) {
 }
 
 type WorkspaceObservation struct {
-	slug  string
-	facts []ArtifactFact
-	index map[ArtifactPath]int
+	slug      string
+	facts     []ArtifactFact
+	index     map[ArtifactPath]int
+	rootFiles []RootFile
+}
+
+// RootFile is one regular file directly inside the workspace root.
+type RootFile struct {
+	Name  string
+	Bytes int64
+}
+
+// RootFiles lists the workspace root's regular files so a consumer can judge
+// placement without acquiring the directory itself.
+func (o *WorkspaceObservation) RootFiles() []RootFile {
+	return append([]RootFile(nil), o.rootFiles...)
 }
 
 func (o *WorkspaceObservation) Slug() string { return o.slug }
@@ -296,7 +310,39 @@ func observeWorkspace(root, slug string, callback observationCallback) (*Workspa
 	for i, fact := range facts {
 		index[fact.path] = i
 	}
-	return &WorkspaceObservation{slug: slug, facts: facts, index: index}, nil
+	rootFiles, err := readRootFiles(roots.workspace)
+	if err != nil {
+		return nil, ObservationWorkspaceInvalid
+	}
+	return &WorkspaceObservation{slug: slug, facts: facts, index: index, rootFiles: rootFiles}, nil
+}
+
+// readRootFiles lists the workspace directory's regular entries through the
+// already-verified root handle, so the list describes the same snapshot as the
+// artifact facts.
+func readRootFiles(root *os.Root) ([]RootFile, error) {
+	dir, err := root.Open(".")
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = dir.Close() }()
+	entries, err := dir.ReadDir(-1)
+	if err != nil {
+		return nil, err
+	}
+	files := make([]RootFile, 0, len(entries))
+	for _, entry := range entries {
+		if !entry.Type().IsRegular() {
+			continue
+		}
+		info, err := entry.Info()
+		if err != nil {
+			return nil, err
+		}
+		files = append(files, RootFile{Name: entry.Name(), Bytes: info.Size()})
+	}
+	sort.Slice(files, func(i, j int) bool { return files[i].Name < files[j].Name })
+	return files, nil
 }
 
 func observationWorkspaceOverrideValid(root, slug string) bool {

package/engine/internal/state/status.go

@@ -7,17 +7,21 @@ import (
 
 // Report is the computed completeness status of a feature at its current phase.
 type Report struct {
-	Slug              string
-	Phase             Phase
-	Status            string
-	NextAction        string
-	PrinciplesPresent bool
-	Required          map[Section]bool
-	Missing           []Section // required-but-empty sections, in policy order
-	RequiredFiles     map[string]bool
-	MissingFiles      []string // required-but-empty workspace files, in lifecycle order
-	present           map[Section]bool
-	diagnostics       []ArtifactDiagnostic
+	Slug                        string
+	Phase                       Phase
+	Status                      string
+	NextAction                  string
+	SequenceParent              string
+	SequencePosition            string
+	SequenceWorkspacesRemaining string
+	SequenceRole                string
+	PrinciplesPresent           bool
+	Required                    map[Section]bool
+	Missing                     []Section // required-but-empty sections, in policy order
+	RequiredFiles               map[string]bool
+	MissingFiles                []string // required-but-empty workspace files, in lifecycle order
+	present                     map[Section]bool
+	diagnostics                 []ArtifactDiagnostic
 }
 
 // Status computes phase-relative completeness from one retained workspace observation.
@@ -38,13 +42,13 @@ func statusWithCallback(root, slug string, callback observationCallback) (*Repor
 	return newObservationReport(observation, phase, policy), nil
 }
 
-func observationCursorFields(observation *WorkspaceObservation) (status, nextAction string, principlesPresent bool) {
+func observationCursorFields(observation *WorkspaceObservation) (status, nextAction, sequenceParent, sequencePosition, sequenceRemaining, sequenceRole string, principlesPresent bool) {
 	if fact, ok := observation.Fact(".devrites/principles.md"); ok && fact.State() == ArtifactPresent {
 		principlesPresent = true
 	}
 	fact, ok := observation.Fact(LedgerFile)
 	if !ok || fact.State() != ArtifactPresent {
-		return "", "", principlesPresent
+		return "", "", "", "", "", "", principlesPresent
 	}
 	lines := strings.Split(string(fact.Bytes()), "\n")
 	if value, ok := CursorField(lines, CursorStatus); ok {
@@ -53,7 +57,11 @@ func observationCursorFields(observation *WorkspaceObservation) (status, nextAct
 	if value, ok := CursorField(lines, CursorNextAction); ok {
 		nextAction = value
 	}
-	return status, nextAction, principlesPresent
+	sequenceParent, _ = CursorField(lines, CursorSequenceParent)
+	sequencePosition, _ = CursorField(lines, CursorSequencePosition)
+	sequenceRemaining, _ = CursorField(lines, CursorSequenceWorkspacesRemain)
+	sequenceRole, _ = CursorField(lines, CursorSequenceRole)
+	return status, nextAction, sequenceParent, sequencePosition, sequenceRemaining, sequenceRole, principlesPresent
 }
 
 func newObservationReport(observation *WorkspaceObservation, phase Phase, policy PhasePolicy) *Report {
@@ -65,19 +73,23 @@ func newObservationReport(observation *WorkspaceObservation, phase Phase, policy
 	for i, artifact := range missingArtifacts {
 		missingFiles[i] = string(artifact)
 	}
-	status, nextAction, principlesPresent := observationCursorFields(observation)
+	status, nextAction, sequenceParent, sequencePosition, sequenceRemaining, sequenceRole, principlesPresent := observationCursorFields(observation)
 	return &Report{
-		Slug:              observation.Slug(),
-		Phase:             phase,
-		Status:            status,
-		NextAction:        nextAction,
-		PrinciplesPresent: principlesPresent,
-		Required:          required,
-		Missing:           missingObservationSections(present, policy.RequiredSections),
-		RequiredFiles:     requiredFiles,
-		MissingFiles:      missingFiles,
-		present:           present,
-		diagnostics:       diagnostics,
+		Slug:                        observation.Slug(),
+		Phase:                       phase,
+		Status:                      status,
+		NextAction:                  nextAction,
+		SequenceParent:              sequenceParent,
+		SequencePosition:            sequencePosition,
+		SequenceWorkspacesRemaining: sequenceRemaining,
+		SequenceRole:                sequenceRole,
+		PrinciplesPresent:           principlesPresent,
+		Required:                    required,
+		Missing:                     missingObservationSections(present, policy.RequiredSections),
+		RequiredFiles:               requiredFiles,
+		MissingFiles:                missingFiles,
+		present:                     present,
+		diagnostics:                 diagnostics,
 	}
 }
 

package/engine/internal/state/taskgraph.go

@@ -23,11 +23,34 @@ type TaskGraphResult struct {
 
 var (
 	sliceHeaderRE  = regexp.MustCompile(`(?m)^##\s+(SLICE-\d+)\b`)
+	anyH2HeaderRE  = regexp.MustCompile(`(?m)^##\s`)
 	dependenciesRE = regexp.MustCompile(`(?m)^Dependencies:\s*(.+)\s*$`)
 	dependsOnRE    = regexp.MustCompile(`(?m)^depends_on:\s*(.+)\s*$`)
 	sliceIDValidRE = regexp.MustCompile(`^SLICE-\d+$`)
 )
 
+// ValidSliceID reports whether id has the canonical SLICE-### shape.
+func ValidSliceID(id string) bool { return sliceIDValidRE.MatchString(id) }
+
+// ExtractTaskSlice returns the first `## SLICE-###` section of tasks.md whose ID
+// equals id, from its heading up to the next level-2 heading. It lets a phase read
+// one slice instead of the whole file.
+func ExtractTaskSlice(tasksMarkdown []byte, id string) (string, bool) {
+	text := string(tasksMarkdown)
+	for _, match := range sliceHeaderRE.FindAllStringSubmatchIndex(text, -1) {
+		if text[match[2]:match[3]] != id {
+			continue
+		}
+		rest := text[match[1]:]
+		end := len(text)
+		if next := anyH2HeaderRE.FindStringIndex(rest); next != nil {
+			end = match[1] + next[0]
+		}
+		return strings.TrimRight(text[match[0]:end], "\n") + "\n", true
+	}
+	return "", false
+}
+
 // ParseTaskGraph reads tasks.md content and validates the slice dependency DAG.
 func ParseTaskGraph(tasksMarkdown []byte) TaskGraphResult {
 	text := string(tasksMarkdown)

package/engine/main.go

@@ -30,9 +30,11 @@ Usage:
   devrites-engine check skill-trust <path> Scan one skill/agent Markdown for trust violations
   devrites-engine observe summary <slug>   Emit sanitized JSON workspace summary
   devrites-engine orient <slug>            Alias for observe summary
+  devrites-engine observe slice <slug> <SLICE-ID>  Print one SLICE-### section of tasks.md
   devrites-engine check indexes [--root <dir>]  Report manifest and code-index presence as JSON
   devrites-engine parallel <subcommand>   Deterministic parallel worktree lease/create/integrate/cleanup
   devrites-engine state resolve <qid> "<ans>"  Resolve an open question and update state atomically
+  devrites-engine state merge-manifest <slug> [pred...]  Fold the recorded predecessor chain's manifests into the release candidate manifest
   devrites-engine state close <slug>       Archive a shipped feature and clear ACTIVE
   devrites-engine migrate <slug> [--dry-run]  Normalize a pre-v5 workspace to the current schema
   devrites-engine secret-scan [--staged] [--stdin] [slug]  Scan exact staged blobs, stdin, or touched files; HIGH blocks
@@ -144,18 +146,24 @@ func cmdCandidate(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "candidate: BLOCKED: %v\n", err)
 		return exitBlocked
 	}
+	if err := lib.VerifyReleaseUnion(root, args[0]); err != nil {
+		fmt.Fprintf(stderr, "candidate: BLOCKED: %v\n", err)
+		return exitBlocked
+	}
 	fmt.Fprintf(stdout, "candidate-sha256: %s\ncandidate-files: %d\n", digest, files)
 	return exitOK
 }
 
 func cmdState(root string, args []string, stdout, stderr io.Writer) int {
 	if len(args) == 0 {
-		fmt.Fprintln(stderr, "usage: devrites-engine state <resolve|close> ...")
+		fmt.Fprintln(stderr, "usage: devrites-engine state <resolve|merge-manifest|close> ...")
 		return exitUsage
 	}
 	switch args[0] {
 	case "resolve":
 		return lib.Resolve(root, args[1:], stdout, stderr)
+	case "merge-manifest":
+		return lib.RunMergeManifest(root, args[1:], stdout, stderr)
 	case "close":
 		return lib.CloseOut(root, args[1:], stdout, stderr)
 	default:
@@ -192,6 +200,10 @@ func cmdGate(root string, kind gate.Kind, args []string, stdout, stderr io.Write
 		return exitBlocked
 	}
 	if kind == gate.Seal {
+		if err := lib.VerifyReleaseUnion(root, args[0]); err != nil {
+			fmt.Fprintf(stdout, "release-union: BLOCKED: %v\nreason: %s\n", err, gate.ResultReasonID(kind, true))
+			return exitBlocked
+		}
 		code := lib.EvidenceFresh(root, []string{args[0]}, stdout, stderr)
 		if code == exitUsage {
 			return exitUsage
@@ -223,22 +235,29 @@ func cmdSkillTrust(args []string, stdout, stderr io.Writer) int {
 
 func cmdObserve(root string, args []string, stdout, stderr io.Writer) int {
 	if len(args) == 0 {
-		fmt.Fprintln(stderr, "usage: devrites-engine observe summary <slug>")
-		return exitUsage
-	}
-	if args[0] != "summary" {
-		fmt.Fprintf(stderr, "devrites: unknown observe command %q\n", args[0])
+		fmt.Fprintln(stderr, "usage: devrites-engine observe summary <slug> | observe slice <slug> <SLICE-ID>")
 		return exitUsage
 	}
-	slug, code, err := lib.ActiveSlug(root, args[1:])
-	if err != nil {
-		fmt.Fprintf(stderr, "observe: %v\n", err)
-		if code == 0 {
-			code = exitUsage
+	switch args[0] {
+	case "summary":
+		slug, code, err := lib.ActiveSlug(root, args[1:])
+		if err != nil {
+			fmt.Fprintf(stderr, "observe: %v\n", err)
+			if code == 0 {
+				code = exitUsage
+			}
+			return code
 		}
-		return code
+		return lib.RunObserveSummary(root, slug, stdout, stderr)
+	case "slice":
+		if len(args) != 3 {
+			fmt.Fprintln(stderr, "usage: devrites-engine observe slice <slug> <SLICE-ID>")
+			return exitUsage
+		}
+		return lib.RunObserveSlice(root, args[1], args[2], stdout, stderr)
 	}
-	return lib.RunObserveSummary(root, slug, stdout, stderr)
+	fmt.Fprintf(stderr, "devrites: unknown observe command %q\n", args[0])
+	return exitUsage
 }
 
 func cmdOrient(root string, args []string, stdout, stderr io.Writer) int {

package/engine/root_routing_test.go

@@ -23,6 +23,7 @@ func TestRootModeForCoversReadAndWriteSurfaces(t *testing.T) {
 		{name: "check path-disjoint", command: "check", args: []string{"path-disjoint"}, want: rootUnused},
 		{name: "check skill-trust", command: "check", args: []string{"skill-trust"}, want: rootUnused},
 		{name: "observe summary", command: "observe", args: []string{"summary"}, want: rootStrictUsage},
+		{name: "observe slice", command: "observe", args: []string{"slice"}, want: rootStrictUsage},
 		{name: "orient", command: "orient", want: rootStrictUsage},
 		{name: "check indexes", command: "check", args: []string{"indexes"}, want: rootLenient},
 		{name: "resolve", command: "state", args: []string{"resolve"}, want: rootStrict},
@@ -115,6 +116,7 @@ func TestNestedCommandFamiliesAreRoutedAndAdvertised(t *testing.T) {
 		{"check", "indexes"},
 		{"orient", "feature"},
 		{"observe", "summary", "feature"},
+		{"observe", "slice", "feature", "SLICE-001"},
 		{"state", "resolve"},
 		{"state", "close"},
 	} {
@@ -145,7 +147,7 @@ func TestNestedCommandFamilyUsageListsOnlyRetainedCommands(t *testing.T) {
 		removed []string
 	}{
 		{args: []string{"check"}, want: "check <candidate|readiness|seal|path-disjoint|task-graph|skill-trust|indexes>", removed: []string{"spec"}},
-		{args: []string{"state"}, want: "state <resolve|close>", removed: []string{"clarify", "tick-afk", "recovery"}},
+		{args: []string{"state"}, want: "state <resolve|merge-manifest|close>", removed: []string{"clarify", "tick-afk", "recovery"}},
 	} {
 		t.Run(test.args[0], func(t *testing.T) {
 			var stdout, stderr bytes.Buffer

package/install.sh

@@ -245,9 +245,12 @@ dr_acquire_engine "$SELF_DIR" install "$DEVRITES_REPO" || { echo "error: could n
 ENGINE="$DR_ENGINE_PATH"
 PAYLOAD="${DEVRITES_HOST_ARTIFACT_DIR:-$SELF_DIR/pack/generated}"
 if [ ! -d "$PAYLOAD/claude/skills" ] || [ ! -d "$PAYLOAD/codex/skills" ] \
+  || [ ! -d "$PAYLOAD/pi/skills" ] || [ ! -d "$PAYLOAD/pi/agents" ] \
+  || [ ! -d "$PAYLOAD/pi/prompts" ] \
   || [ ! -f "$PAYLOAD/claude/skills/devrites-lib/reference/standards/agents.md" ] \
   || [ ! -f "$PAYLOAD/codex/skills/devrites-lib/reference/standards/agents.md" ] \
-  || [ ! -f "$PAYLOAD/codex/config.toml" ]; then
+  || [ ! -f "$PAYLOAD/pi/skills/devrites-lib/reference/standards/agents.md" ] \
+  || [ ! -f "$PAYLOAD/codex/config.toml" ] || [ ! -f "$PAYLOAD/pi/AGENTS.md" ]; then
   BUILDER="$SELF_DIR/scripts/build-host-artifacts.sh"
   [ -f "$BUILDER" ] || { echo "error: generated install payload missing at $PAYLOAD and builder missing at $BUILDER" >&2; exit 1; }
   DEVRITES_HOST_ARTIFACT_DIR="$PAYLOAD" bash "$BUILDER" >/dev/null || { echo "error: could not generate install payload at $PAYLOAD" >&2; exit 1; }

package/pack/.claude/agents/devrites-code-reviewer.md

@@ -1,6 +1,6 @@
 ---
 name: devrites-code-reviewer
-description: Reviews one DevRites feature diff for /rite-review and /rite-seal with fresh context. Checks tests first, then correctness, readability, architecture, maintainability, and standards. Finds defects instead of rubber-stamping the change.
+description: Reviews a full DevRites feature diff once for /rite-review and /rite-seal. Checks tests, correctness, readability, architecture, maintainability, and standards; returns every supported finding.
 tools: Read, Grep, Glob, Bash
 permissionMode: plan
 ---
@@ -40,9 +40,11 @@ From `spec.md`'s applicability map, load only triggered `repository-topology.md`
 
 You receive a feature slug or workspace path (`.devrites/work/<slug>/`) and the
 diff scope. Read `spec.md` for the objective and acceptance criteria, then
-`tasks.md`, `decisions.md`, `touched-files.md`, and `.devrites/principles.md` if
-present. The principles are binding project invariants. Run `git diff` for the
-feature scope and read the touched files.
+`decisions.md` and `.devrites/principles.md` if present. Read `tasks.md` and
+`touched-files.md` by the schema's bounded rule: when `devrites-engine orient <slug>`
+reports one over budget, index it (`grep -n`) and load only entries naming this
+candidate's AC/slice IDs. The principles are binding project invariants. Run `git diff`
+for the feature scope and read the touched files.
 
 ## Review (feature scope only)
 
@@ -108,12 +110,13 @@ not as a blocker on this diff.
 
 ## Rules
 
-- Stay in feature scope (touched files + diff). Out-of-scope problems → FYI follow-ups.
+- Out-of-scope problems → FYI.
 - Do **not** edit code. Return findings only.
 - Read surrounding source (call sites, existing guards, nearest consumer) before assigning severity; don't rate impact from the diff hunk alone.
 - Label each finding **Critical / Important / Suggestion / Nit / FYI** with `file:line`
   and a concrete fix. No praise padding.
-- If you can't verify something, say so explicitly rather than assuming it's fine.
+- Return every supported in-scope finding from the full inspected diff in this one pass, not only the first. Repeat canonical `Finding:`/`Basis:` rows; unverified → gap. Complete means evidenced coverage, not guaranteed defect-free.
+- In a recheck (the packet names open findings and a correction diff), your verdict covers those findings, the changed hunks, and their dependents. Anything else on hunks unchanged since your previous pass goes under `Late:` with severity and `file:line`; it is recorded for `/rite-review`, not verdict-bearing.
 - **Non-trigger (UI anti-slop):** if the diff touches no rendered UI surface, do not
   fire UI anti-slop (Inter, lavender, gradient, emoji headers). Code anti-slop still
   applies. The UI catalog is `devrites-frontend-reviewer`.

package/pack/.claude/agents/devrites-doubt-reviewer.md

@@ -59,6 +59,12 @@ mirror.
 
 - Don't edit anything. Return findings only.
 - Be concrete: the exact scenario that breaks it, with `file:line` where relevant.
+- Tag every `valid & actionable` finding `kind: contract` (the claim's guarantee is
+  wrong or unpinned) or `kind: mechanism` (the guarantee stands; a named test would
+  catch the wrong implementation — propose that case).
+- When the packet names prior fingerprints and a correction diff, your verdict covers
+  those and the dependents of each changed clause. Other observations on unchanged
+  text go under `Late:` with severity and site; they are recorded, not verdict-bearing.
 
 ## Output
 

package/pack/.claude/agents/devrites-plan-reviewer.md

@@ -107,7 +107,13 @@ criterion, slice, or proof.
   pad the report with praise. In a recheck, also mark each finding
   `new_failure_mode` or name the already-pinned clause/fingerprint it refines —
   the packet lists prior repairs; the mark makes alias-detection and
-  `convergence_pressure` eligibility mechanical.
+  `convergence_pressure` eligibility mechanical. Tag every Critical/Important
+  `kind: contract` (an implementer could build it differently and still pass the
+  planned tests) or `kind: mechanism` (a named test can discriminate the wrong
+  implementation; propose that case as the fix, not new plan prose).
+- In a recheck, your verdict covers the listed fingerprints, the correction diff, and
+  the dependents of each changed clause. Anything else you notice on unchanged text
+  goes under `Late:` with severity and site; it is recorded, not verdict-bearing.
 - When a dimension has no issue, say "strong: <why>" instead of inventing a
   finding.
 - If a claim cannot be verified, such as blast radius without an index, say so and